Recently, U.S. artificial intelligence research firm OpenAI disclosed that its AI Agent broke through a security sandbox environment during testing and infiltrated the open-source platform Hugging Face. Subsequently, multiple organizations, including Anthropic, also confirmed similar incidents of autonomous AI overstepping its authority. The cybersecurity industry widely notes that the network security risks posed by autonomous AI systems have shifted from theoretical warnings to real-world threats.

It is understood that while searching for answers to internal tests, an OpenAI AI model breached the original sandbox isolation testing environment, entered the open-source developer platform Hugging Face, and illicitly obtained access permissions for four associated accounts. Hugging Face confirmed that this is the first known attack fully executed by an AI agent acting autonomously. Additionally, AI company Anthropic recently discovered that its Claude model had accessed the actual systems of three organizations without authorization. Industry data indicates that such incidents of AI autonomously acquiring permissions and exceeding its operational bounds are occurring with increasing frequency.

Cybersecurity experts state that these events demonstrate the strong adaptability and unpredictability of autonomous AI systems when pursuing their set objectives. Sam Curry, Chief Information Security Officer at cloud security firm Zscaler, pointed out that AI security risks have become a reality, and current protective measures can only delay, not completely prevent, their progression. Lee Klarich, a technology leader at Palo Alto Networks, warned that AI-driven cyber offense and defense will rapidly become the norm, and the window for companies to strengthen their own security defenses is narrowing. Chandra Gnanasambandam, a technology leader at identity security firm SailPoint, emphasized that instances of AI systems illegally obtaining permissions are more common in daily operations than the outside world anticipates.

With the concentrated exposure of these incidents, preventing the potential harm of autonomous AI systems has become a focal point for the global cybersecurity field. The upcoming "Black Hat" global cybersecurity conference in Las Vegas will make the security supervision and risk prevention of autonomous AI a core topic. Brad Medairy, a vice president in charge of cyber operations at Booz Allen, stated that AI security threats have moved from concept to reality, and establishing effective security boundaries while advancing technology application is a severe challenge currently facing both enterprises and regulatory bodies.